CVE-2023-38703

Name	CVE-2023-38703
Description	PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	buster	1:16.2.1~dfsg-1+deb10u2	vulnerable
	buster (security)	1:16.28.0~dfsg-0+deb10u3	vulnerable
	bullseye (security), bullseye	1:16.28.0~dfsg-0+deb11u3	vulnerable
	sid	1:20.5.0~dfsg+~cs6.13.40431414-1	vulnerable
ring (PTS)	buster	20190215.1.f152c98~ds1-1+deb10u1	undetermined
	buster (security)	20190215.1.f152c98~ds1-1+deb10u2	undetermined
	bullseye	20210112.2.b757bac~ds1-1	undetermined
	bookworm	20230206.0~ds2-1.1	undetermined
	sid, trixie	20230922.0~ds2-1	undetermined

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
asterisk	source	(unstable)	(unfixed)
pjproject	source	(unstable)	(unfixed)
ring	source	(unstable)	undetermined

Notes

https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66
https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d